Skip to content

Commit 28ae3c0

Browse files
bosheng1iViggyPrabhu
authored andcommitted
drm/virtio: process virtgpu bo before bo free
during virtio_gpu_cleanup_object, bo is accessed after freeing bo. this patch is to avoid buffer use-after-free. Tracked-On: OAM-131753 Signed-off-by: Xue, Bosheng <bosheng.xue@intel.com>
1 parent c8fcb93 commit 28ae3c0

1 file changed

Lines changed: 3 additions & 5 deletions

File tree

drivers/gpu/drm/virtio/virtgpu_object.c

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,9 @@ void virtio_gpu_cleanup_object(struct virtio_gpu_object *bo)
9898
struct virtio_gpu_device *vgdev = bo->base.base.dev->dev_private;
9999

100100
virtio_gpu_resource_id_put(vgdev, bo->hw_res_handle);
101+
virtio_gpu_object_del_restore_list(vgdev, bo);
102+
if (bo->prime)
103+
kfree(bo->ents);
101104
if (virtio_gpu_is_shmem(bo)) {
102105
drm_gem_shmem_free(&bo->base);
103106
} else if (virtio_gpu_is_vram(bo)) {
@@ -113,11 +116,6 @@ void virtio_gpu_cleanup_object(struct virtio_gpu_object *bo)
113116
drm_gem_object_release(&vram->base.base.base);
114117
kfree(vram);
115118
}
116-
117-
if (bo->prime)
118-
kfree(bo->ents);
119-
120-
virtio_gpu_object_del_restore_list(vgdev, bo);
121119
}
122120

123121
static void virtio_gpu_free_object(struct drm_gem_object *obj)

0 commit comments

Comments
 (0)